Are the fees incurred by phone owners to receive verification-codes sent as sms messages legal?

Question

The question
Are the fees incurred by phone owners to receive verification-codes sent as sms messages legal ?

When registering to make new email-accounts( etc ) those companies often send you a verification-code ( 2FA ) in an sms to confirm that you do actually own that phone-number, and receiving that sms often incurs some sort of fee / cost on your phone-account.

LINK - Multi-factor authentication ( MFA; two-factor authentication, or 2FA )

• Quote from above link - "Mobile carriers may charge the user for messaging fees. "

• Malicious people could do false account registrations using someone else s phone-number just in order to incur fees on them

• What if some companies send these sms as self-deleting sms messages ( or invisible sms messages if there is such a thing ? ), then the receiver would not be able to work out what is eating their phone-credit ?

• NOTE - I have not been able to find out if fees are only incurred if the verification-code is successfully used to sign-up for a new account ( or re-verify ID etc ).

• I wonder if this question should be more general and cover any sms messages that incur a fee on the receiver.

NOTE - I just realized that I may have posted this question based on my incorrect assumption that verification-code sms-messages may be treated differently to normal sms-messages on a phone-account where normally the receipt of all sms-messages seems to be free, when in fact the phone-carriers would probably never be able to tell the difference between verification-code sms-messages and normal sms-messages.
( The text shown by email-account sign-up webpages like "Receipt of the verification-code sms-message may incur a charge." and also forgetting about countries where receivers pay for calls or sms, prompted me to post this question )

Answer 1

Having worked on a web development team whose product used an SMS OTP function, I think the question is laboring under a misunderstanding of what these disclaimers usually say and what they're for.

Neither the company operating the app/website, nor their carrier, charges the user for sending one-time passwords. We are billed by the carrier for each OTP we send; we certainly aren't going after them to collect from the user! We don't update them on whether the passwords were used or anything of that nature, because they don't really care - they charge us the same amount whether you look at the message or not.

However, while we don't charge the end user, we can't guarantee that the user's carrier won't charge them for receiving an SMS, either directly or indirectly (e.g., if it counts against your data limit). We don't know who the user's carrier is, let alone have any guarantees from them about what charges might apply.

Answer 2

germany

Are the fees incurred by phone owners to receive verification-codes sent as sms messages legal?

No, they would not be. I say "would not", because they do not exist in Germany, for that reason.

First, would it be legal to send you the code? While it is forbidden to "cold call" you, you explicitely asked for and agreed to be send this code. Since you gave your consent, any laws about what is allowed without consent become irrelevant to your question.

So would it be legal for your phone provider to charge you fees based on receiving messages? No, it is not.

While parties can form any contract they like, as long as it isn't illegal, there are some constraints. One such constraint is that the contract has to be "transparent" to both parties. So they need to know, what they sign. This is called Transparenzgebot (§ 307 Abs. 1 Satz 2 BGB)

For example, a contract that says "you need to work as much overtime as required" is not allowed, simply because one party has neither control over, nor any information about how much overtime that actually will be when they sign the contract. While for example "You need to work 10 hours of unpaid overtime per week" is ridiculously unfair, the employee knows exactly what that means and can decide for themselves, if that is a contract they want to sign.

Example for such a court decision: BAG, Urteil vom 1. 9. 2010 – 5 AZR 517/09.

So any contract that has one party pay for something they cannot control and cannot possibly quantify before singing the contract, would be invalid, at least that specific part of the contract. And "messages other people I might not even know send me without me being able to stop them" is certainly one of those.

Please note that telecom providers could make their contract quantifiable. But neither telecom companies nor their customers would put up with such stupid contracts.

Answer 3

In the US, it is not forbidden to charge a customer for receiving a call. However, it could be a violation of the particular contract between customer and provider to charge for incoming calls, just as it might be a breach of contract to charge for outgoing calls (if the customer has an unlimited calls contract). It is also not illegal in the US to charge a customer for internet data use, again with the proviso that the contract could guarantee that there will be no charges for data use.